docs(releases): finalize the 17.6.0 notes after publish

[hotlong]

What this is

The release-time half of the 17.6.0 release notes, following #20623 for 17.5.0.

The page content/docs/releases/v17/17-6.mdx landed before publish (#21290) with a RELEASE-TIME TODO. 17.6.0 was published to latest on 2026-10-02 from the version commit 617f25f8 (#20639): @objectstack/cli at 02:53Z, @objectstack/spec at 03:03Z. This PR makes the TODO's edits, deletes both TODO comments, and updates content/docs/releases/v17/index.mdx.

Docs-only, two files under the release-owned content/docs/releases/. Nothing is published, hence skip-changeset.

Clause-②: no

What changed

17-6.mdx

• Publish date. 2026-10-02, 3 days after 17.5.0.

• Count. The version commit consumed 337 changesets (the .changeset/*.md files it deletes, README excluded). The draft read 338.

  • The 69 CHANGELOG.md files that carry a 17.6.0 section at 617f25f8 list 496 per-package entries (198 minor, 298 patch) in 48 of those files.
  • Those entries de-duplicate to the same 337.
  • Every consumed changeset was already in the draft, so nothing new needed folding in.
  • New in 17.6.0: 337 − 16 shipped in 17.5.0 = 321.

• New section "Also shipped in 17.6.0 — not in its CHANGELOG".

  • 748b240 (feat(types,automation): a host's per-kernel scheduled-work OFF reports its own reason #21270, hostDisabledReason) is an ancestor of the version commit, but the version commit did not consume its changeset.
  • The npm packages therefore carry it, and no 17.6.0 CHANGELOG names it. HotCRM's upgrade observed the same (chore(deps): upgrade @objectstack/* to 17.6.0 hotcrm#1982).
  • This is the same window that produced 17.5.0's seven stragglers. I filed it as release: a Version Packages PR that merges behind main ships every changeset landed since its last refresh without a CHANGELOG entry (17.5.0: 8 changesets, 17.6.0: 1) #21361.

• Console.

  • The pin stayed 31971ff1e28f.
  • The known-issues list gains the zh-CN defect: console strings render in English (objectui#11326, fixed upstream in d0fba91aa). QA run · priority:P0 + 17.6-risk (42/42) · 617f25f8 · 2026-10-02 · 30 PASS / 3 PARTIAL / 9 FAIL / 0 BLOCKED / 0 NOT-RUN #21330 confirmed it on 17.6.0.
  • The release verification reproduced the dataset and datasource saves on 17.6.0.

• New section "Known issues found after publish". It draws on the three 17.6.0 verification lanes:

  • the HotCRM upgrade, chore(deps): upgrade @objectstack/* to 17.6.0 hotcrm#1982;
  • the North Star path on the published packages, QA run · north-star path published 17.6.0 (11/13) · 617f25f8 · 2026-10-02 · 2 PASS / 8 PARTIAL / 1 FAIL / 0 BLOCKED / 2 NOT-RUN #21318;
  • the P0 + 17.6-risk checklist run, QA run · priority:P0 + 17.6-risk (42/42) · 617f25f8 · 2026-10-02 · 30 PASS / 3 PARTIAL / 9 FAIL / 0 BLOCKED / 0 NOT-RUN #21330.

  The issues it lists:

  • 17.6.0: os migrate meta --stored (preview) and os migrate audit-metadata-bodies (dry run) boot the app's seed loader and write to application tables #21349: the --stored and audit-metadata-bodies previews write to the database;
  • os package install (install-local) drops an app's script action bodies: REST 404 and MCP run_action "No handler registered" while list_actions advertises the action #21321 / Hot install via os package install leaves record-change flows unbound and the package's permission sets unprojected until a restart, and says nothing #21322: local package install loses script action bodies, and a hot install leaves flows unbound;
  • objectstack verify reports "✓ verify passed" (exit 0) on a stack that os validate, os build and os lint refuse — and the published CLI docs do not document verify #21323 / objectstack verify --json writes hundreds of INFO log lines to stdout ahead of the JSON payload, so verify --json > report.json is not parseable #21324: verify passes a refused stack, and its --json output is not clean;
  • approvals: "My Pending" never lists a request routed to a position — the console filters with approverId=role:<p>, the request stores position:<p>, and the list filter matches literally #21350: "My Pending" misses position-routed approvals (pre-existing);
  • automation: a cloned packaged flow reaches no Studio surface — the clone is stored with no package, and every Studio Automations rail lists only package-scoped flows #21332: a cloned flow reaches no Studio surface;
  • security(core, plugin-security): an unauthenticated principal never resolves the permission sets bound to the guest anchor; ADR-0090 D9 is declared and seeded but not enforced #21158: anonymous endpoints;
  • the console pin issues.

  The authorization-class finding in QA run · priority:P0 + 17.6-risk (42/42) · 617f25f8 · 2026-10-02 · 30 PASS / 3 PARTIAL / 9 FAIL / 0 BLOCKED / 0 NOT-RUN #21330 (R2) is deliberately not described here.

• Upgrade checklist. 19 of 30 lines are now marked Exercised on HotCRM (a 17.5.0 app with a 17.5.0-created SQLite DB), 2026-10-02, each with what was observed, taken from hotcrm#1982's per-line table.

  • Lines that do not apply to HotCRM stay Not exercised.
  • Two lines gain a ⚠️ for 17.6.0: os migrate meta --stored (preview) and os migrate audit-metadata-bodies (dry run) boot the app's seed loader and write to application tables #21349, telling operators to run the previews on a copy.
  • One line is new: os validate --strict now fails on dead keys. HotCRM got +88 warnings.

• Unchanged. security(core, plugin-security): an unauthenticated principal never resolves the permission sets bound to the guest anchor; ADR-0090 D9 is declared and seeded but not enforced #21158 is still open, so its "no supported channel" lines stay.

v17/index.mdx (following #20623)

• The frontmatter description runs through 17.6.0.
• The status blockquote says 17.6.0 is released and current, published 2026-10-02, taking over from 17.5.0. A plain install resolves 17.6.0, and the minors warning names 17.6.0.
• A new "17.6.0 stays in that register" paragraph links the breaking changes, the known issues and the checklist.
• The per-release list marks 17.6.0 as current. The checklist callout records that 17.5.0 → 17.6.0 was exercised in part (19 lines, on HotCRM), and the checklist links lead with 17.6.0.
• The top-level content/docs/releases/index.mdx already reads "current series: 17.6.0", stamped at version time.

Verification

Run locally on the head commit. All of these pass:

• check-issue-citations --base origin/main
• check-doc-anchors (406 links)
• check-role-word
• check-release-page-status
• check-release-section-coverage, plain and --strict
• check:release-index-currency-sync
• check-docs-single-h1
• check-release-notes
• check-doc-frontmatter

Both pages compile as MDX with @mdx-js/mdx 3 + remark-gfm.

🤖 Generated with Claude Code

https://claude.ai/code/session_014VGCS11YUtYAiinRcdqQwL

---

Generated by Claude Code